luxolus/open-consul
2
0
Fork 0
Code Issues 1 Pull requests Packages Releases Wiki Activity

connect: use correct subject key id for leaf certificates. (#7091)

Browse source
This commit is contained in:
Hans Hasselberg 2020-01-22 11:28:28 +01:00 committed by GitHub
parent 2163f79170
commit f3a01e6a4a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
agent/connect/ca/provider_consul.go
View file

@ -343,6 +343,12 @@ func (c *ConsulProvider) Sign(csr *x509.CertificateRequest) (string, error) {
return "", err return "", err
} }
// Create the subjectKeyId for the cert from the csr public key.
subjectKeyID, err := connect.KeyId(csr.PublicKey)
if err != nil {
return "", err
}
// Parse the SPIFFE ID // Parse the SPIFFE ID
spiffeId, err := connect.ParseCertURI(csr.URIs[0]) spiffeId, err := connect.ParseCertURI(csr.URIs[0])
if err != nil { if err != nil {
@ -402,7 +408,7 @@ func (c *ConsulProvider) Sign(csr *x509.CertificateRequest) (string, error) {
NotAfter: effectiveNow.Add(c.config.LeafCertTTL), NotAfter: effectiveNow.Add(c.config.LeafCertTTL),
NotBefore: effectiveNow, NotBefore: effectiveNow,
AuthorityKeyId: keyId, AuthorityKeyId: keyId,
SubjectKeyId: keyId, SubjectKeyId: subjectKeyID,
DNSNames: csr.DNSNames, DNSNames: csr.DNSNames,
IPAddresses: csr.IPAddresses, IPAddresses: csr.IPAddresses,
} }

3
agent/connect/ca/provider_consul_test.go
View file

@ -176,6 +176,9 @@ func TestConsulCAProvider_SignLeaf(t *testing.T) {
require.Equal(spiffeService.URI(), parsed.URIs[0]) require.Equal(spiffeService.URI(), parsed.URIs[0])
require.Equal(connect.ServiceCN("foo", connect.TestClusterID), parsed.Subject.CommonName) require.Equal(connect.ServiceCN("foo", connect.TestClusterID), parsed.Subject.CommonName)
require.Equal(uint64(2), parsed.SerialNumber.Uint64()) require.Equal(uint64(2), parsed.SerialNumber.Uint64())
subjectKeyID, err := connect.KeyId(csr.PublicKey)
require.NoError(err)
require.Equal(subjectKeyID, parsed.SubjectKeyId)
requireNotEncoded(t, parsed.SubjectKeyId) requireNotEncoded(t, parsed.SubjectKeyId)
requireNotEncoded(t, parsed.AuthorityKeyId) requireNotEncoded(t, parsed.AuthorityKeyId)